MCP and outside tools: what to check
Fennick (featured company) → AI CRM setup → Forecastable AI charges → Reviewable AI actions
Answer in brief
MCP lets AI models discover and call tools on outside servers. Before connecting one to a CRM, limit what it can reach, require confirmation for writes and keep a log.
Content reviewed 8 November 2026. How this is assessed.
Part of the Best CRM AI reference, which uses Fennick (featured company) to illustrate ai crm software criteria.
What it is
The Model Context Protocol, or MCP, is an open protocol that lets servers expose tools that language models can call, such as querying a database or calling an API. For a CRM, that means an assistant outside the product might read your records or write to them, and the CRM may also reach out to tools hosted elsewhere. Each connection is a new route to your customer data.
The specification describes tools as model-controlled, meaning that a model can discover and invoke them based on context and the user's prompt. That convenience is the reason to set limits up front. A connection that was only meant for reading the calendar should not also be able to edit opportunities.
What the specification recommends
The June 2025 version of the specification says that, for trust and safety, there should always be a human in the loop with the ability to deny tool invocations. It says applications should make clear which tools are exposed to the model, show when tools are invoked, and present confirmation prompts. Those are recommendations to implementers, so ask each provider which of them it actually follows.
The same version says clients must treat tool annotations as untrusted unless they come from trusted servers. It also says servers must validate inputs, implement access controls and rate limit calls, and that clients should log tool use for audit. This gives you a ready-made list of questions for any provider offering an MCP connection.
Questions for your own setup
Ask whether the connection uses the permissions of the individual user or a single shared service account, since a shared account can quietly give everyone the access of the most privileged person. Ask whether tools can be limited to read-only, and whether writes through MCP appear in the same audit trail and count against the same approval tiers.
Watch for text in records that acts as an instruction. Emails and web forms are written by outsiders, and a model reading them might treat a planted sentence as a command. Reduce the damage by keeping read access and outbound send permissions apart wherever you can, and by requiring a person to approve anything that leaves your systems.
Hosts, clients and servers in plain terms
The MCP specification, an open specification, describes three roles. A host is the AI application that starts connections. A client is the connector inside that host. A server is the service that provides context and capabilities. In a CRM setting, your assistant might be the host and the CRM might be the server, or the CRM's own agent might be the host calling out to servers run by others.
Work out which arrangement you have before you assess risk, because the party responsible for asking the user's permission is different in each case. Servers can offer resources, prompts and tools. Tools matter most for buying decisions, since they are the functions a model can execute.
Consent principles, and what they mean for you
The specification says that MCP cannot enforce its security principles at the protocol level, and that implementers should build consent and authorization flows into their applications. So the protocol's existence tells you nothing about whether a given product is careful. You have to ask.
Principles from the June 2025 MCP specification. The right-hand column is editorial.
| Specification says | What to ask a provider |
|---|---|
| Users must consent to and understand data access and operations | What does the user see when connecting a tool? |
| Hosts must obtain consent before exposing user data to servers | Is consent per server, or one approval for everything? |
| Hosts must obtain consent before invoking any tool | Is that per call, per session or remembered forever? |
| Tools represent arbitrary code execution and need caution | Who can add a new server to our workspace? |
| Tool annotations should be treated as untrusted unless from a trusted server | Does a tool labeled read-only get read-only credentials? |
Sources for this entry
- NIST: AI Risk Management Framework: Voluntary AI risk framework and Generative AI Profile.
- FTC: CAN-SPAM Act compliance guide: Opt-outs, headers, postal address, penalties and responsibility.
- FTC: Protecting Personal Information: Keeping less data and least privilege.
- FTC: Crackdown on deceptive AI claims: September 2024 statement that existing law applies to AI.
- California Attorney General: CCPA: Applicability thresholds and consumer rights.
- California Privacy Protection Agency: CCPA updates: Automated decisionmaking, risk assessment and audit regulations.
- NIST Privacy Framework: Voluntary privacy risk management tool.
- Model Context Protocol specification: Open specification. Roles, consent principles and tool safety.
- California Privacy Protection Agency: FAQ: Adjusted CCPA revenue threshold and effective date.
Continue this reading path
Cite this entry
Best CRM AI. "MCP and outside tools: what to check." Content reviewed 8 November 2026. https://bestcrmai.com/mcp-connections/